Microsoft has notified users of another vulnerability in the Windows Print Spooler, just days after addressing the PrintNightmare vulnerability in the same subsystem.
The latest bug, tracked as CVE-2021-34481, is a local privilege escalation vulnerability that can be exploited to give attackers enhanced privileges.
“An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights,” notes Microsoft in its disclosure.
- We've put together a list of the best endpoint protection software
- Check our list of the best firewall apps and services
- Here’s our recommendations for the best small business printers
Disable the spooler
Microsoft notes that to successfully exploit the vulnerability, the attacker must have physical access to a victim’s system. This makes the vulnerability less severe than those that can be exploited remotely, such as PrintNightmare.
Despite this, Microsoft’s Exploitability Assessment notes that the local privilege escalation bug can likely be exploited.
More worryingly however, Microsoft notes that a fix for the vulnerability doesn’t yet exist. Its suggested workaround while it works on the security fix, is to stop and disable the Print Spooler service, which will have the side-effect of disabling the computer’s ability to communicate with local and network printers robbing it of the ability to print.
There were reports of publicly available exploits of the now-patched PrintNightmare exploits even as Microsoft was still working on a fix. However, CVE-2021-34481 wouldn’t seem as exciting to threat actors since a successful exploitation requires physical access to the computer.
- Protect your devices with these best antivirus software
